Migrating to a SASE platform and still hauling around hundreds of legacy firewall rules from your on-prem stack? That's a guaranteed way to pay for performance and security you'll never use. Most migration guides tell you to "analyze and clean up" your rule base, but they never give you the tools to do it at scale.
I wrote a Python script that actually does the work. It connects to your existing firewall (tested on Palo Alto and Fortinet XML exports), parses the rules, and cross-references them against actual flow logs from your network (NetFlow, IPFIX, or proxy logs). It outputs a clear report, but more importantly, it can generate a *sanitized* rule set for your SASE migration, stripping out rules with zero hits over a defined period.
Here's the core logic that identifies stale rules. You'll need to adapt the data source connectors for your environment.
```python
def identify_stale_rules(rule_list, flow_data, threshold_days=90):
"""
rule_list: List of dicts with 'source', 'destination', 'port', 'hits_last_seen'
flow_data: Aggregated list of flows from logs
Returns list of rules with no matching flows in threshold_days.
"""
stale_rules = []
current_time = datetime.now()
for rule in rule_list:
last_hit = rule.get('hits_last_seen')
if last_hit:
days_inactive = (current_time - last_hit).days
if days_inactive >= threshold_days:
stale_rules.append(rule)
else:
# Rule never logged a hit, check against flow data
if not flow_matches_rule(flow_data, rule):
stale_rules.append(rule)
return stale_rules
def flow_matches_rule(flow_data, rule):
# Simplified logic: check if any flow matches rule criteria
for flow in flow_data:
if (flow['src_ip'] in rule['source_cidr'] and
flow['dst_ip'] in rule['destination_cidr'] and
flow['dst_port'] == rule['port']):
return True
return False
```
Key features:
* Handles both stateful firewall exports and flow log formats.
* Separates "never hit" rules from "formerly active but now stale" rules.
* Outputs a CSV for review and a JSON file that can be templated into SASE policy objects.
* Requires you to define the threshold; I recommend starting with 90 days for most enterprises.
The blunt truth: If you don't do this cleanup *before* the migration, you'll be trying to untangle a mess of shadow policies and "break-fix" rules in a new console while dealing with performance complaints. This script forces data-driven decisions. I've used it to cut rule sets by 60-70% in two migrations, which directly translated to simpler security postures and fewer migration headaches.
What it doesn't do: handle application-layer rules or user-based policies natively—you need to map those separately. It also requires decent flow log coverage; gaps will cause false positives.
Has anyone else built similar tooling? I'm particularly interested in how you handled the mapping of legacy NAT rules to the new SASE architecture.
Show me the query.